mlsanityData to 7 Oct 2026

False Claims against Model Ownership Resolution

arXiv 2304.06607 ↗First posted 13 Apr 2023cs.CR cs.AIcited by 17

Not on the map. Why?

Abstract (arXiv)

Deep neural network (DNN) models are valuable intellectual property of model owners, constituting a competitive advantage. Therefore, it is crucial to develop techniques to protect against model theft. Model ownership resolution (MOR) is a class of techniques that can deter model theft. A MOR scheme enables an accuser to assert an ownership claim for a suspect model by presenting evidence, such as a watermark or fingerprint, to show that the suspect model was stolen or derived from a source model owned by the accuser. Most of the existing MOR schemes prioritize robustness against malicious suspects, ensuring that the accuser will win if the suspect model is indeed a stolen model. In this paper, we show that common MOR schemes in the literature are vulnerable to a different, equally important but insufficiently explored, robustness concern: a malicious accuser. We show how malicious accusers can successfully make false claims against independent suspect models that were not stolen. Our core idea is that a malicious accuser can deviate (without detection) from the specified MOR process by finding (transferable) adversarial examples that successfully serve as evidence against independent suspect models. To this end, we first generalize the procedures of common MOR schemes and show that, under this generalization, defending against false claims is as challenging as preventing (transferable) adversarial examples. Via systematic empirical evaluation, we show that our false claim attacks always succeed in the MOR schemes that follow our generalization, including in a real-world model: Amazon's Rekognition API.

Key facts. Cited by 17 papers in the map (data through 7 Oct 2026). Builds on 54 of its 90 references that are in the map. First posted on arXiv 13 Apr 2023.

Builds on

54 of 90 references.

References · 54

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  7. 2016Wide Residual Networkscited by 3,057
  8. 2016Adversarial examples in the physical worldcited by 1,762
  9. 2019Similarity of Neural Network Representations Revisitedcited by 1,695
  10. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 968
  11. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  12. 2019Towards Federated Learning at Scale: System Designcited by 826
38 more
  1. 2017SphereFace: Deep Hypersphere Embedding for Face Recognitioncited by 733
  2. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  3. 2019Adversarial Training for Free!cited by 638
  4. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  5. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  6. 2017One pixel attack for fooling deep neural networkscited by 579
  7. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  8. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  9. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  10. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  11. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  12. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  13. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  14. 2016Improving the Robustness of Deep Neural Networks via Stability Trainingcited by 156
  15. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  16. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  17. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  18. 2020Stealing Links from Graph Neural Networkscited by 114
  19. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
  20. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
  21. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 90
  22. 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 82
  23. 2021Proof-of-Learning: Definitions and Practicecited by 81
  24. 2020Imitation Attacks and Defenses for Black-box Machine Translation Systemscited by 78
  25. 2018Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Datacited by 69
  26. 2021A survey of deep neural network watermarking techniquescited by 69
  27. 2019IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundarycited by 68
  28. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  29. 2020Cryptanalytic Extraction of Neural Network Modelscited by 65
  30. 2019How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNNcited by 58
  31. 2020A Systematic Review on Model Watermarking for Neural Networkscited by 49
  32. 2019Robust Watermarking of Neural Network with Exponential Weightingcited by 48
  33. 2017Enhancing Robustness of Machine Learning Systems via Data Transformationscited by 38
  34. 2015Foveation-based Mechanisms Alleviate Adversarial Examplescited by 32
  35. 2019BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networkscited by 25
  36. 2019Extraction of Complex DNN Models: Real Threat or Boogeyman?cited by 19
  37. 2021"Adversarial Examples" for Proof-of-Learningcited by 19
  38. 2022MetaV: A Meta-Verifier Approach to Task-Agnostic Model Fingerprintingcited by 16

50 most cited of 54 All 54 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 4; 2025: 7; 2026: 3.

17 papers.

Sort:

By area:

  1. 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attributioncited by 35
  2. 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
  3. 2025FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprintcited by 8
  4. 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspectivecited by 8
  5. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  6. 2024MergePrint: Merge-Resistant Fingerprints for Robust Black-box Ownership Verification of Large Language Modelscited by 6
  7. 2025ImF: Implicit Fingerprint for Large Language Modelscited by 5
  8. 2024GENIE: Watermarking Graph Neural Networks for Link Predictioncited by 3
  9. 2025Watermarking Graph Neural Networks via Explanations for Ownership Protectioncited by 3
  10. 2024Revisiting Black-Box Model Ownership Verification through Information Theorycited by 2
  11. 2025From Construction to Injection: Edit-Based Fingerprints for Large Language Modelscited by 2
  12. 2025SELF: A Robust Singular Value and Eigenvalue Approach for LLM Fingerprintingcited by 2
5 more
  1. 2026SIF: Semantically In-Distribution Fingerprints for Large Vision-Language Modelscited by 2
  2. 2023FLARE: Fingerprinting Deep Reinforcement Learning Agents using Universal Adversarial Maskscited by 1
  3. 2025WGLE:Backdoor-free and Multi-bit Black-box Watermarking for Graph Neural Networkscited by 1
  4. 2026Attesting Model Lineage by Consisted Knowledge Evolution with Fine-Tuning Trajectorycited by 1
  5. 2026MeMark: Membrane-Space Watermarking for Spiking Neural Networkscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Model-Guardian: Protecting against Data-Free Model Stealing Using Gradient Representations and Deceptive Predictions
  2. 2025Evading Data Provenance in Deep Neural Networks
  3. 2025Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessment
  4. 2025Stealix: Model Stealing via Prompt Evolution
  5. 2026Membership is Ownership: A Robust Ownership Verification Framework for Diffusion Models
  6. 2025D-REX: A Benchmark for Detecting Deceptive Reasoning in Large Language Models
  7. 2025Verifying LLM Inference to Detect Model Weight Exfiltration
  8. 2024Domain Bridge: Generative model-based domain forensic for black-box models